Security Compliance

Configure ARM for the use of nested groups in the ARM user management

This article describes how to configure ARM to resolve nested groups during ARM logon.

First published date

6/5/2019 8:12 PM

Last published date

10/28/2020 2:38 PM

Overview

This article describes how to modify the ARM server configuration file so that ARM resolves nested group memberships at login.

Product section

Access Rights Manager

Cause

With ARM default settings, users can only log on to ARM if they are direct group members. Users from nested groups cannot log on to ARM.

Resolution

  1. Determine the maximum nesting depth to use. The login time to ARM increases exponentially in relation to the nesting depth. Group nesting should be kept as flat as possible.
  2. Open the configuration file pnServer.config.xml under %ProgramData%\protected-networks.com\8MAN\cfg
  3. Add or modify the configuration switch: <server.userManagement.maxGroupResolveDepth type="System.Int32">2</server.userManagement.maxGroupResolveDepth>
  4. Adjust the value for the maximum nesting depth. Values can range from 2 - 9 for the maximum resolved nesting depth.